By Cain Burdeau – Courthouse News – July 14, 2020
Spain was rocked Tuesday by allegations that the government may have hacked a smartphone used by the pro-independence president of the Catalan parliament and spied on him and others during a tense period in the run-up to a politically explosive trial against Catalan leaders.
Allegations that the Spanish state may have used an Israeli company’s hacking spyware to target Roger Torrent, the speaker and president of Catalonia’s regional parliament, were revealed in a joint investigation by the newspapers El País and The Guardian.
The domestic espionage claims open a new chapter in an emotional and epochal fight in Spain over the future of Catalonia and its capital Barcelona. About half of Catalonia’s population wants to secede from Spain. An unauthorized independence referendum in 2017 led to massive protests, police violence, the arrests of Catalan politicians and the criminal conviction of pro-independence leaders last October.
The newspaper reports about the hacking of Torrent’s phone sprang from a wide-ranging probe by digital experts at a Canadian university into allegations that authoritarian governments around the world have abused technology developed by Israeli hacker-for-hire firm NSO Group and taken control of cellphones to spy on dissidents, journalists, lawyers, activists, human rights advocates and opposition politicians. NSO is fighting numerous lawsuits in the United States and elsewhere against it over its spying program called Pegasus.
NSO claims no responsibility for how its Pegasus spyware is used by governments and says it only sells the spyware to governments to help them fight crime and terrorism. The Pegasus program can take control of a phone, its cameras and microphones, and mine the user’s personal data.
Spanish authorities denied any knowledge of the alleged spying on Torrent.
Andrew Dowling, an expert on Spanish politics and history at Cardiff University, said the allegations against Spanish authorities appear solid.
“In one sense it is not that surprising at all,” he said in an email to Courthouse News. It appears, he said, that “sectors of the Spanish security services act autonomously and are not fully subject to democratic control.”
Torrent called on the Spanish state to investigate the claims. He said he was unsure who was behind the hacking but he suspects state actors carried out the surveillance without judicial authority.
“The espionage I have been subjected to violates my right to privacy, the right to secrecy of communications and the right to be able to develop a political project without illegitimate interference,” Torrent said on Tuesday in a statement to media at the Catalan parliament. “It is inappropriate in a democracy that state apparatuses illegally spy on political opponents.”
He charged that the evidence confirms the Spanish state is seeking to use illegal means to squash Catalonia’s drive for independence.
“This is the first time, therefore, that what many of us already knew and have been denouncing for a long time has been conclusively proven: espionage against political opponents is practiced in Spain,” he said.
He said he was told about the alleged hacking by newspaper reporters and that he feared his smartphone’s camera and microphone were remotely turned on to spy on him. He said the Pegasus program allowed hackers to listen to all his conversations on the phone and those that took place while the phone was close at hand. He said conversations he had with politicians, trade union members, economic leaders and international representatives had been put at risk.
“This type of software is intended for use in investigating complex and serious crimes, such as terrorism or drug trafficking,” Torrent said. He said watchdogs, including United Nations Rapporteur on freedom of expression David Kaye and Amnesty International, have warned that governments in Morocco, Mexico and Saudi Arabia have abused the Pegasus software to spy on opponents.
“Now,” he said, “we know that this practice has also occurred in Spain.”
He said Catalan authorities will “take all political and legal action” to “get to the bottom of the matter.”
The hacking of Torrent’s phone was confirmed by Citizen Lab, a center that researches digital threats, the newspapers reported. Citizen Lab is working with the social media platform WhatsApp to find improper hacking that took place around the world in April and May 2019 by exploiting a previous weakness in WhatsApp. The lab is based at the Munk School of Global Affairs at the University of Toronto.
Besides Torrent, a former Catalan parliamentarian, Anna Gabriel, and pro-Catalan activist Jordi Domingo also were hacked, according to the newspapers. Gabriel fled Spain after the Spanish state cracked down on the Catalan independence drive in 2017 and she remains in exile in Switzerland. Other Catalan politicians, most notably former Catalan President Carles Puigdemont, also fled Spain to avoid arrest. Puigdemont is a member of the European Parliament and condemned the alleged domestic espionage on Tuesday.
John Scott-Railton, a senior researcher at Citizen Lab, said on Twitter that there is a “troubling sign of a pattern of political hacking in Spain.”
The newspaper reports said WhatsApp believes the hacking took place between April and May 2019 and involved 1,400 of its users around the world. Until now, European governments had not been linked to the hacking attack.
WhatsApp is suing the NSO Group in the U.S. and charges that the Pegasus program was used to hack more than 100 journalists, human rights activists, diplomats and government officials in various countries around the world. The Pegasus program has been linked to surveillance of associates of slain Saudi Arabian journalist Jamal Khashoggi.
Citizen Lab says Bahrain, Kazakhstan, Mexico, Morocco, Saudi Arabia, the United Arab Emirates and India have been linked to abusive use of the spyware to target civil society.
Citizen Lab says the software is among the world’s most sophisticated commercial spyware and can be deceptively placed on phones without a user’s knowledge or permission. Once the software infects a phone, hackers can obtain a person’s private data, including passwords, contact lists, calendar events, text messages, and live voice calls, Citizen Lab says. Hackers can also turn on the phone’s camera and microphone to monitor activity in the phone’s vicinity and track someone’s movements through GPS, the group says.
On Monday, NSO won a case in an Israeli court brought by Amnesty International seeking to stop the company from selling its software around the world.
Spanish authorities said they were not behind the hacking of Torrent’s phone.
The newspapers said the National Intelligence Center, Spain’s domestic and foreign intelligence service, issued a statement saying it acts “in full accordance with the legal system” and that its work is overseen by Spain’s Supreme Court.
Socialist Spanish Prime Minister Pedro Sanchez also issued a statement saying his “government has no evidence” that Torrent was hacked, according to the newspapers. The hacking allegations have the potential to sour relations between Sanchez and Catalan politicians upon whose cooperation he depends in the Spanish parliament.
The hacking allegedly took place while Sanchez was prime minister and may erode trust in the Socialist leader’s promises to open dialogue with the Catalan separatists to find a political solution to demands for Catalan independence.
Torrent called on Sanchez to live up to his pledges, he is leading a progressive government in coalition with the far-left Podemos party.
“A government that claims to be the most progressive in history cannot allow such practices to go unpunished,” Torrent said. “We cannot make it normal for there to be prospective wiretaps, to criminalize a peaceful and democratic movement.”
Dowling, the Cardiff University expert, doubted the Spanish state or European Union institutions will investigate the allegations.
“Spain has little tradition of independent investigation into political scandals, however deep,” he said. “The fact that it has had widespread European coverage will be embarrassing but I don’t perceive the EU intervening in what it will consider to be the internal affairs of the Spanish state.”
Courthouse News reporter Cain Burdeau is based in the European Union.